Remote Code Execution Vulnerability in Cisco ISE Products

CVE-2026-20147

What is CVE-2026-20147?

A vulnerability has been identified in Cisco Identity Services Engine (ISE) and its platform extension Cisco ISE-PIC, allowing an authenticated remote attacker to execute arbitrary commands on the underlying operating system. The flaw arises from inadequate validation of user-supplied input, enabling attackers with valid administrative credentials to send specially crafted HTTP requests to exploit the vulnerability. Successful exploitation grants user-level access to the operating system, with potential elevation to root privileges. In single-node deployments of ISE, this could result in complete unavailability of the ISE node, leading to a denial of service condition that disrupts network access for unauthenticated endpoints until the node is restored. For more detailed information, please refer to the Cisco Security Advisory.

References